Replying to Avatar Jameson Lopp

So the ByBit attack was able to happen because:

Gnosis Safe front end is a web app whose JavaScript gets served from an Amazon S3 bucket.

A Gnosis Safe developer had production AWS keys saved on their machine.

The Dev's machine was compromised and the AWS key used to deploy a malicious front end that only targeted ByBit's wallet.

JavaScript web apps have no cryptographic integrity checks to ensure the code being delivered was actually written by the expected author.

Signing complex EVM transactions can't be done securely on airgapped hardware because the hardware simply doesn't have all of the contextual information needed to know the outcome of executing the transaction.
Avatar
ahplummer 10mo ago

FINALLY!! All the podcasts, all the posts, tweets about all this never made any sense until this write-up. This makes 100% sense now.

TLDR:

* AWS key exploited

* Malicious JS targeted for one by modifying it in the S3 bucket

Thanks nostr:npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tp ! You connected the dots for me.

Reply to this note

Please Login to reply.

Discussion

No replies yet.